Skip to content

Commit 3cb93f3

Browse files
Stanley.Yangalexdeucher
authored andcommitted
drm/amdgpu: fix use-after-free during gpu recovery
[Why] [ 754.862560] refcount_t: underflow; use-after-free. [ 754.862898] Call Trace: [ 754.862903] <TASK> [ 754.862913] amdgpu_job_free_cb+0xc2/0xe1 [amdgpu] [ 754.863543] drm_sched_main.cold+0x34/0x39 [amd_sched] [How] The fw_fence may be not init, check whether dma_fence_init is performed before job free Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
1 parent f2e1aa2 commit 3cb93f3

1 file changed

Lines changed: 5 additions & 1 deletion

File tree

drivers/gpu/drm/amd/amdgpu/amdgpu_job.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,11 @@ static void amdgpu_job_free_cb(struct drm_sched_job *s_job)
169169
amdgpu_sync_free(&job->sync);
170170
amdgpu_sync_free(&job->sched_sync);
171171

172-
dma_fence_put(&job->hw_fence);
172+
/* only put the hw fence if has embedded fence */
173+
if (!job->hw_fence.ops)
174+
kfree(job);
175+
else
176+
dma_fence_put(&job->hw_fence);
173177
}
174178

175179
void amdgpu_job_set_gang_leader(struct amdgpu_job *job,

0 commit comments

Comments
 (0)